cmd: fix limitedRead returning nil error when Stat fails

[Nilesh Patil (nileshpatil6)]

Summary

limitedRead in cmd/containerd-shim-runhcs-v1/delete.go can return a nil error on failure. The Stat result is checked inside an if statement, so its err is scoped to that statement, and the err in the final return refers to the outer variable from os.Open, which is always nil once execution gets there:

f, err := os.Open(filePath)            // err == nil past this check
...
if fi, err := f.Stat(); err == nil {   // shadows err
    ...
}
return []byte{}, errors.Wrapf(err, "limited read failed during file stat: %s", filePath)

errors.Wrapf returns nil for a nil error, so a Stat failure produces ([]byte{}, nil). The caller in the delete handler then takes neither branch: err == nil && len(logBytes) > 0 is false, and err != nil is false, so the shim panic log is silently skipped without even the "failed to open shim panic log" warning.

Change

• Restructure the function the way the containerd-shim-lcow-v2 copy (cmd/containerd-shim-lcow-v2/manager.go) already does, so the Stat error is actually returned.
• Switch both copies from f.Read(buf) to io.ReadFull with the read count sliced off. f.Read may return fewer bytes than requested without an error, and the old code returned the full buffer regardless, so a short read handed back NUL padding that was never in the file. Same reasoning as ext4/dmverity: use io.ReadFull when reading the super block and root hash #2888.
• Add the same limitedRead unit tests the lcow shim already has, since the runhcs-v1 copy had none.

Verification

go build ./cmd/containerd-shim-runhcs-v1/          ok
go vet   ./cmd/containerd-shim-runhcs-v1/          ok
go test  ./cmd/containerd-shim-runhcs-v1/ -run TestLimitedRead   PASS
go build -tags lcow ./cmd/containerd-shim-lcow-v2/ ok
go test  -tags lcow ./cmd/containerd-shim-lcow-v2/ -run TestLimitedRead   ok

on Windows 11.